CVE-2026-15206: SMS Alert WordPress Auth Bypass Flaw

CVE-2026-15206 Overview

CVE-2026-15206 is an authentication bypass vulnerability in the SMS Alert WordPress plugin before version 3.9.8. The plugin does not bind its "mobile verified" session flag to the phone number that was actually verified during one-time password (OTP) validation. After an attacker verifies an OTP sent to their own phone, the signup and login handler reads a fresh, attacker-supplied phone number to select the target account. An unauthenticated attacker can log in as any user, including an administrator, who has a billing phone on file. The issue is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated remote attackers can impersonate any WordPress account, including administrators, by decoupling OTP verification from the phone number used at login.

Affected Products

SMS Alert WordPress plugin versions prior to 3.9.8
WordPress sites using SMS Alert for OTP-based login or signup
WordPress sites where users have a billing phone number on file

Discovery Timeline

2026-08-02 - CVE-2026-15206 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15206

Vulnerability Analysis

The SMS Alert plugin implements phone-based authentication using an OTP flow. A user requests an OTP, the plugin sends the code to a supplied phone number, and the user submits the code for verification. Once verified, the plugin stores a session flag indicating that mobile verification succeeded.

The defect lies in how the session flag is scoped. The flag records only that verification occurred, not which phone number was verified. When the signup or login handler runs, it re-reads the phone number from the current request and uses it to select the WordPress user account to authenticate. An attacker completes the OTP challenge against their own number, then submits a different phone number belonging to the victim to complete login.

Root Cause

The root cause is a broken trust boundary between the verification step and the account selection step. The session state records a boolean rather than the identifier that was validated. Because the verified phone number is not bound to the session flag, the plugin cannot detect that the phone number presented at login differs from the one that received the OTP.

Attack Vector

Exploitation requires no authentication and no user interaction beyond controlling one attacker-owned phone number. The attacker registers or initiates login with their own phone, receives and submits a valid OTP, then substitutes the victim's billing phone number in the final login request. The plugin honors the mobile-verified flag and issues a session for the victim account. Any account with a stored billing phone, including administrator accounts, can be taken over.

No public proof-of-concept is available. Technical detail is documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-15206

Indicators of Compromise

Successful WordPress logins for privileged accounts originating from IP addresses or user agents not previously associated with those users.
OTP verification events immediately followed by login events referencing a different phone number in request parameters.
New administrator sessions on WordPress sites running SMS Alert plugin versions earlier than 3.9.8.

Detection Strategies

Inspect web server access logs for sequential POST requests to the SMS Alert OTP verification and login endpoints where the phone number parameter changes between requests in the same session.
Correlate WordPress wp_login audit entries with SMS Alert OTP delivery logs to identify logins that lack a matching OTP for the account's phone number.
Alert on privilege changes and role assignments that follow OTP-based logins within a short interval.

Monitoring Recommendations

Enable WordPress audit logging for authentication, user creation, and role changes, and forward events to a centralized SIEM.
Track failed and successful OTP submissions per source IP to detect enumeration and phone-substitution attempts.
Review installed plugin inventory across all WordPress sites and flag any SMS Alert version below 3.9.8.

How to Mitigate CVE-2026-15206

Immediate Actions Required

Upgrade the SMS Alert plugin to version 3.9.8 or later on every affected WordPress site.
Force a password reset and session invalidation for all administrator and privileged accounts that had billing phone numbers on file.
Audit the WordPress wp_users and wp_usermeta tables for unexpected role escalations or newly created administrators.

Patch Information

The vendor has released version 3.9.8 of the SMS Alert plugin, which addresses the improper authentication issue by binding OTP verification state to the specific phone number that was validated. Refer to the WPScan Vulnerability Report for release details.

Workarounds

Disable the SMS Alert plugin until the update to 3.9.8 can be applied.
Remove or blank billing phone numbers from administrator accounts to prevent phone-based account selection while the plugin remains vulnerable.
Restrict access to WordPress login and OTP endpoints using web application firewall rules or IP allow lists.

bash

# Configuration example: disable the plugin from the command line using WP-CLI
wp plugin deactivate sms-alert
wp plugin status sms-alert